office-malware-analyzer

To analyze Office malware and extract IOCs, the skill processes OOXML, OLE, and RTF files to detect malicious macros, DDE, and embedded payloads, generating structured IOC reports with URLs, IPs, and domains.

VBA stomping detection works by extracting and comparing source code with executed P-code using pcodedmp and oletools, identifying discrepancies where malicious p-code overrides the visible source code in Office documents.

Yes, you can extract and deobfuscate XLM macros from Excel files. The skill uses XLMMacroDeobfuscator alongside oletools to analyze legacy Excel 4.0 macros and identify malicious embedded payloads.

The best way to detect DDE and template injections is by parsing OOXML and RTF structures to identify external links and dynamic data exchange objects, mapping the detected threats to MITRE ATT&CK techniques.

Yes, the skill supports RTF and OOXML formats. It analyzes these Office document formats to identify external links, embedded objects, DDE exploits, EPS payloads, and known CVE indicators.

When analyzing PowerPoint files, limitations depend on available python libraries. The skill requires oletools, yara-python, and XLMMacroDeobfuscator to successfully extract macros and assess CVE indicators across Office formats.